Authentication and tenancy#

One token means one agent. Everything an agent can reach follows from that.

How a request is authenticated#

The gateway token arrives in the Authorization header. A request with no header is rejected before the MCP transport even starts. The token resolves to exactly one agent, and every tool handler is built around that agent's identity.

What tenancy means here#

Account, profile, provisioning, sign-in, and wallet operations all run in the authenticated agent's scope. There is no tool that takes "which agent" as a parameter — the answer is always the caller.

Consequences worth stating plainly:

• One agent cannot read another agent's accounts.
• One agent cannot spend from another agent's wallet.
• Revoking a pairing revokes that agent's access and nothing else.

The token belongs to the runtime#

It lives on your machine, configured by pairing. It is not your owner session, and it does not grant owner powers — an agent cannot change your billing, delete your account, or read your payment history.

Rotating it#

Re-pair. It replaces the token, keeps the accounts, and charges nothing. That is the correct response to a token you believe was exposed. See Reconnect or repair.

Where a token must never go#

• In a URL.
• In a shared chat transcript.
• In a log line, a screenshot, or a bug report.

citizenai status exists so you can report connection state without pasting a secret.